Privacy Policy

Last updated: 12 July 2026

Plain-language, written for parents, and product-accurate. It is a thorough starting draft — have privacy counsel review it before launch, and fill the bracketed [operator details] and governing-law specifics. This is not legal advice.

Who this is for

Maker Caper is a coding game for children. A parent or guardian (the “grown-up”) creates and owns the account. Children play under profiles the grown-up sets up. We designed the product to collect as little as possible.

What we collect

• Parent account: your email and name (for sign-in, receipts, and support), and a securely hashed password.
• Child profiles: a display name and an avatar choice you pick. Please use a nickname or first name only. We ask for no email, birthday, photo, or other personal information about the child.
• Gameplay progress: which puzzles were solved and stars earned, tied to a child profile — so progress syncs across devices.
• Technical & security data: your IP address and browser/device type, used to keep the account secure and prevent abuse (sign-in sessions, rate limiting).
• On-device gameplay stats: some difficulty-tuning stats are stored only in your browser and are never sent to us.
• Email preferences: whether you opted in to optional updates, and when. Off by default.
• Payments: handled by Stripe. We never see or store your card number; we keep only a subscription status and Stripe’s customer reference.

What we do NOT do

• No advertising and no third-party ad tracking.
• No selling or “sharing” (as defined by US state privacy laws) of personal information, and no data brokers.
• No collecting personal details from children beyond the display name/avatar you choose.

Children’s privacy (COPPA)

Maker Caper is designed to comply with the US Children’s Online Privacy Protection Act (COPPA). Because kid profiles contain no personal information — only a display name and avatar you choose, used solely to run the game — there is minimal child data to begin with. We still ask you, the account-holding parent, to confirm your consent before any child profile is created, and you can withdraw that consent at any time from Account settings. If we ever changed the product to collect personal information from a child, we would first obtain verifiable parental consent by a COPPA-approved method.

Legal bases we rely on (EU/UK users)

This section applies if Maker Caper is offered to users in the EU/UK — your counsel should confirm territorial scope. Where it applies, we process personal data on these bases:

• To provide the service (account, sign-in, child profiles, progress sync, billing): performance of a contract with the parent (Art. 6(1)(b)).
• Security, abuse-prevention, and difficulty tuning: our legitimate interests (Art. 6(1)(f)).
• Optional marketing email: your consent (Art. 6(1)(a)), which you can withdraw at any time.

Service providers we share data with

We use a small set of vetted providers to run Maker Caper. We only share what each needs:

• Cloudflare — website hosting and our database (account, profiles, progress).
• Stripe — payment processing. Stripe handles your card; we receive only a subscription status and a customer reference.
• Resend — sending email: account messages (e.g. password resets) always, and, only if you opt in, optional updates. Resend receives your parent email and first name.

We are based in Canada, and some of our providers (Cloudflare, Stripe, Resend) store or process data in the United States and elsewhere. Under Canadian privacy law (PIPEDA) we remain accountable for your information wherever it is processed and use providers that offer a comparable level of protection. For EU/UK users, where applicable we rely on appropriate transfer safeguards such as Standard Contractual Clauses / the UK Addendum and, where certified, the EU–US Data Privacy Framework.

Marketing emails

Optional and off by default. If you opt in (at signup or in Account settings), we add your email and first name to our mailing list to send occasional learning tips and updates. Every marketing email has a one-click unsubscribe, and you can also turn it off any time in Account settings. Account and billing emails (password resets, receipts) are not marketing and are always sent.

How long we keep data

We keep a child’s profile and progress only while the account is active. Delete a profile or your account and that data is deleted promptly — child profiles and their progress cascade-delete, and deleting your account also cancels any subscription. Technical/security data (IP, browser type) is kept for a short rolling window for security. We don’t retain children’s information longer than needed to run the game.

Your controls & rights

• Review your account and children from Account settings.
• Delete a child profile, or delete your entire account (removes children and progress and cancels any subscription).
• Withdraw parental consent (this stops us adding new child profiles; to remove a child’s data, delete the profile or your account).
• Opt out of marketing email any time.

Depending on where you live, you may have rights to access, correct, delete, port, restrict, or object to processing of your personal data, and to withdraw consent. Submit a request via our contact page (choose “Privacy request”); we aim to respond within one month. EU/UK users may also complain to their data protection authority (in the UK, the ICO at ico.org.uk).

Do Not Track & Global Privacy Control: we don’t track users across third-party websites or over time, and we don’t sell or “share” personal information, so there is nothing for a DNT or GPC signal to opt out of here.

Security & storage

Data is stored on Cloudflare infrastructure. Passwords are hashed; payments are processed by Stripe. We apply rate limiting, secure session cookies, and a content security policy.

What laws we’re built for

Maker Caper is operated from Canada and is designed to comply with Canada’s PIPEDA (personal information) and CASL (commercial email — we only send marketing to people who opted in, with a clear unsubscribe and our identity and address in every message). Because the game is made for children, we also design to comply with the US COPPA, and we build toward the principles of the GDPR / UK GDPR and the UK Age Appropriate Design Code and US state privacy laws such as the CCPA/CPRA for users in those regions. We describe our practices honestly and don’t claim any certification.

Our educational approach

How we teach is grounded in established learning-science research (constructionism, cognitive-load and worked-example studies, Parsons problems, productive failure, and spiral curriculum). This informs the game’s design; we don’t claim guaranteed learning outcomes. See the research behind how we teach.

Changes to this policy

We may update this policy; we’ll change the “last updated” date and, for material changes, notify account holders by email or in-app.

Contact & who operates Maker Caper

Maker Caper is operated by 9626956 Canada Inc., 100 Challenger Ave, Ayr, ON N0B 1E0, Canada, phone 647-713-0504. Privacy questions and data requests: contact us or email privacy@makercaper.com. We aim to respond within two business days for general questions and within 30 days for formal data-rights requests.